# S3 Block Public Access
## The rule
S3 Block Public Access, at the account level and the bucket level, blocks public access even when a bucket policy or ACL would allow it. It is the backstop. Keep it on.
## Setup
1. Turn on Block Public Access at the account level: all four sub-settings.
2. Leave it on for every new bucket unless you have a written reason not to.
3. If someone needs an object, generate a presigned URL with a short expiry instead of making the object public. Presigned URLs work with the block in place.
## The classic failure
An agent writes a permissive bucket policy to "make the website work" and the bucket quietly becomes public. With the block on, that policy is inert. Without it, you find out from someone else.
## Verification
1. Run IAM Access Analyzer for S3 to list buckets with public or shared access.
2. Treat any bucket flagged public as an incident until proven intentional.
3. If a bucket must serve public content, front it with CloudFront and keep the bucket itself private.